Four thousand lines and one problem
A customer says their payment failed this morning. The shop's log file has four thousand lines.
Reading it all would take an hour. With two short commands you can find the right lines in a second.
By the end of this lesson
Note
I can read and search text files from the terminal.
Key words
| Word | What it means | Example |
|---|---|---|
| Log file | a text file where a program writes what it did | |
| cat | prints a whole file | cat app.log |
| head | prints the first lines of a file | head -n 3 app.log |
| grep | prints only the lines that match a word | grep ERROR app.log |
| wc | counts lines, words and characters | wc -l app.log |
| Pipe | sends one command's output into the next | | |
The cells students fill in are left blank in this preview.
cat and head show what is inside
A log file is plain text, one event a line. Each line starts with a date and time.
cat app.log prints the whole file. That is fine for a short file.
head app.log prints the first 10 lines. head -n 3 app.log prints the first 3. The -n 3 part is an option.
Read the shop log
printf '%s\n' \
'2026-10-20 09:01 INFO order 1001 placed' \
'2026-10-20 09:03 INFO order 1002 placed' \
'2026-10-20 09:04 WARN payment slow for order 1002' \
'2026-10-20 09:10 ERROR payment failed for order 1003' \
'2026-10-20 09:12 INFO order 1004 placed' \
'2026-10-20 09:15 ERROR stock missing for order 1005' \
'2026-10-20 09:20 WARN email retry for order 1004' \
'2026-10-20 09:22 ERROR payment failed for order 1006' \
> app.log
# Show the whole file.
cat app.log
echo "---- first 3 lines ----"
head -n 3 app.log
grep finds the lines you want
grep ERROR app.log prints only the lines that contain ERROR. Every other line is hidden.
grep matches capital and small letters exactly. Add -i to ignore the difference: grep -i payment app.log.
Search the log
printf '%s\n' \
'2026-10-20 09:01 INFO order 1001 placed' \
'2026-10-20 09:03 INFO order 1002 placed' \
'2026-10-20 09:04 WARN payment slow for order 1002' \
'2026-10-20 09:10 ERROR payment failed for order 1003' \
'2026-10-20 09:12 INFO order 1004 placed' \
'2026-10-20 09:15 ERROR stock missing for order 1005' \
'2026-10-20 09:20 WARN email retry for order 1004' \
'2026-10-20 09:22 ERROR payment failed for order 1006' \
> app.log
# Only the lines that contain ERROR.
grep ERROR app.log
echo "---- payment, any case ----"
grep -i PAYMENT app.log
# Your turn: change the next line to find the WARN lines.
grep ERROR app.log
A common mistake
Warning
Many people think grep error finds lines that say ERROR. It does not, because grep matches the case exactly. Add -i when you are not sure how the word is written.
A pipe joins two commands
The | sign is a pipe. It takes what one command prints and gives it to the next command.
wc -l counts lines. So grep ERROR app.log | wc -l finds the errors, then counts them.
You can join several commands this way. Each one does one small job.
Worked example: the shop log
| Command | What it does | Output |
|---|---|---|
| wc -l app.log | Counts every line | 8 app.log |
| grep ERROR app.log | wc -l | Counts the error lines | 3 |
| grep WARN app.log | wc -l | Counts the warning lines | 2 |
| grep -i payment app.log | wc -l | Counts the payment lines | 3 |
| grep "order 1002" app.log | wc -l | Counts lines about one order | 2 |
The cells students fill in are left blank in this preview.
Count with a pipe
printf '%s\n' \
'2026-10-20 09:01 INFO order 1001 placed' \
'2026-10-20 09:03 INFO order 1002 placed' \
'2026-10-20 09:04 WARN payment slow for order 1002' \
'2026-10-20 09:10 ERROR payment failed for order 1003' \
'2026-10-20 09:12 INFO order 1004 placed' \
'2026-10-20 09:15 ERROR stock missing for order 1005' \
'2026-10-20 09:20 WARN email retry for order 1004' \
'2026-10-20 09:22 ERROR payment failed for order 1006' \
> app.log
# How many lines in the whole file?
wc -l app.log
# How many errors? grep finds them, wc counts them.
grep ERROR app.log | wc -l
# Your turn: count the lines about order 1004.
grep ERROR app.log | wc -l